In 10.20 server syslog is not being written

[vaman]

no syslog written in 10.20 server. syslogd is running.
root 606 1 0 09:45:36 ? 0:00 /usr/sbin/syslogd -D

[Stephen Keane]

What does /etc/syslog.conf look like?

[Bharat Katkar]

Hi Vaman,
Check this threads below:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=186882

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=741077

Hope that helps.
Regards,

[Vitek Pepas]

Does log file exist?

[Florian Heigl (new acc)]

I know that one, but neither I know my workmates remember the real cause.

# check if syslogd is really really listening anymore
netstat -na |grep "*.514"
# should return
#tcp 0 0 *.514 *.* LISTEN
#udp 0 0 *.514 *.*
/sbin/init.d/syslogd stop
cd /var/adm/syslog/syslog.log
mv syslog.log syslog.broken
touch syslog.log
/sbin/init.d/syslogd start
sleep 4
logger test

# check if it's listening again, like in the above

if You don't see 'test' in Your syslog after this think about a fsck of /var

I hope this resolves the issue...

[Robert Salter]

Someone didn't do a 'mv' of syslog.log, then '> syslog.log' to re-create it did they? Because if they did, syslogd is logging into thin air, and it will take up your disk space. Like Florian said, you'll have to stop/start syslogd. The safest way to manually maintain syslog.log is to 'cp' it first then '> syslog.log' to zero it out.

L8tr,

Bob

[Matti_Kurkela]

Stopping and starting syslogd might be a bit overkill. If you send a SIGHUP to syslogd, it should re-read its configuration file and re-open the logfiles. That could also be used to ensure that the switch from old to new logfile(s) happens atomically, so absolutely no messages will be lost.

I think the best method for rotating syslog files would be something like:

cd /var/adm/syslog
# move the old file(s)
# NOTE: syslog will keep logging to the old
# file: don't move it off the filesystem yet
mv syslog.log syslog.old.log

# re-create the logfile(s)
> syslog.log
chmod syslog.log

# switch logging to the new file
# NOTE: this is as close to an atomic
# operation as possible with syslogd
kill -HUP `cat /var/run/syslog.pid`


If you have to rotate the logfiles for some other program which does not provide any internal log rotation facility nor any means to signal "re-open logfile NOW", then the copy-and-truncate may be the best general solution available:

cp otherprogram.log otherprogram.log.old && > otherprogram.log